Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Splunk Core Consultant > Access & Roles > Flashcards

Access & Roles Flashcards

1
Q

What is Authentication?

A
  • Demonstration that you are who you say you are

- The user must prove his/her identity to the server by providing a username and password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Authorization?

A
  • Now that the user is trusted, this determines what you can do as a result
  • Server determines if a client has access to utilize a resource or perform a specific job/task
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are Authentication Methods available in Splunk?

A
  • Native Splunk Accounts
  • LDAP
  • SAML
  • Scripted Authentication
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

If there are SSO or SAML problems, if they are configured, how do login?

A

Add to the login URI:

?login_type=splunk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Where are Splunk’s internal Authentication placed?

A

$SPLUNK_HOME/etc/passwd

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What Authentication method always takes precedence when multiple methods are configured?

A

Splunk “internal”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the most common authentication method?

A

LDAP with AD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In LDAP, what is a DC?

A

Domain Component

ex. dc=splunk, dc=com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

In LDAP, what is a OU?

A

Organizational Unit

ex. ou=people, dc=splunk, dc=com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

In LDAP, what is a CN?

A

Common Name

ex.cn: Peter Gibbons

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What can you ask for from a system administrator to help with configuring Splunk with LDAP?

A

LDAP Data Interchange Format(LDIF)

This will allow you to review all of the attribute/value pairs associated with each and more identify things such as the “Base DN for users” and the “Base DN for groups”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How does authorization work in Splunk?

A
  • In order for a user to login they must have a User Account and A ROLE assigned.
  • Cannot assign Access/Capabilities to a user. They must be assigned to Roles.
  • Roles can only Assign Capabilites, Not Remove them.
  • Rest API Data Access Query
    https: //host:port/services/authorization/roles/admin
  • To faithfully restrict access to data it must be in its own index, and restricted from there. Search time obfuscation can be subverted
  • Create separate indexes for data with diffferent classifications, and User access levels
  • Default User Role has access to all Non-Internal indexes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Can Splunk use multiple LDAP servers?

A

Yes, and as soon as Splunk locates a user on the server, it stops searching.

Search order is determined by the Connection order field..

If the user also has credentials on a server later in the search order, those credentials are ignored.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are some LDAP tools to help you?

A

GUI Apps:

  • Apache Directory Studio
  • Softerra LDAP Vrowser
  • ASDI Edit

Linux CLI:
-ldapsearch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

If SSO is configured, which does Splunk handle, Authentication or Authorization?

A

Authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a user?

A

A persona (individual or shared)

Not always a single -person, might be a shared credential like the base admin user

17
Q

What is Role?

A

a collection of permissions and capabilities

A role is a handle for linking together access rights and capabilities

Cannot assign access/capabiltiies to a user. These must be assigned to roles. If a particular individual needs a specific capability or access, then a role must be created for that user, making it a role of one.

18
Q

What are Capabilities?

A

user actions associated with roles

Capabilities define what the members of a role can do.

Notable examples include the ability to run a real time search.

Applications can extend the base capability.

19
Q

Can you disable capabilities inherited from parent roles?

A

No

20
Q

Roles define Search limits how?

A

How wide a search (time) can be used

How many concurrent searches running

How much disk space can be consumed by search artifacts.

21
Q

What is role inheritance?

A

As a rule, members of multiple roles inherit properties from the role with the broadest permissions.

22
Q

How do users inherit search filter restrictions?

A

The filters are all combined and thus the restrictions for each are applied.

23
Q

How do users inherit allowed indexes?

A

The user is given the highest level of access granted to any role to which they are assigned.

24
Q

How do users inherit capabilities?

A

The user is given the highest level of abilities granted to any role to which they are assigned.

25
Q

What is the srchIndexesDefault setting?

A

A list of indexes to search when no index is specified.

26
Q

What is the srchIndexesAllowed setting?

A

A list of indexes a role is allowed to search.

Splunk Core Consultant (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions